(straw) man in the middle - hyperelliptic org · (straw) man in the middle: a modest post-snowden...

33
(Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 1 / 26

Upload: others

Post on 20-Jun-2020

1 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

(Straw) Man in the Middle:A Modest Post-Snowden Proposal

Brussels, Belgium

Jacob Appelbaum

[redacted]

10 December 2015

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 1 / 26

Page 2: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Post-Snowden?

What does that mean?

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 2 / 26

Page 3: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Understanding the plumbing

Mass surveillance works by first illegally and generally seizing data, andthen indiscriminately searching all data, until a specific search term isfound. This is selector based surveillance, a kind of surveillance thatrequires mass surveillance. It comes from vulnerabilities in core internetand other network protocols.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 3 / 26

Page 4: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

A shift?

We have experienced a huge shift.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 4 / 26

Page 5: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Key changes

Specific understanding about a handful of protocols.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 5 / 26

Page 6: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Key changes

A general and pervasive fear; a feeling of helplessness.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 6 / 26

Page 7: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Key changes

People have lost faith in the authorities and adopted a fatalistic attitude.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 7 / 26

Page 8: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

A new assumption

A pervasive fear of mass surveillance, jokes about being on lists; a newdefault of total monitoring!

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 8 / 26

Page 9: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

A new default to fight passive attackers

Changes are now detectable.

Encryption is here to stay. Passive interception moves to active.Signal/ZRTP clients and Let’s Encrypt CA change the game.This impacts Law Enforcement and Intelligence; focusing on LE.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 9 / 26

Page 10: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

A new default to fight passive attackers

Changes are now detectable.Encryption is here to stay. Passive interception moves to active.

Signal/ZRTP clients and Let’s Encrypt CA change the game.This impacts Law Enforcement and Intelligence; focusing on LE.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 9 / 26

Page 11: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

A new default to fight passive attackers

Changes are now detectable.Encryption is here to stay. Passive interception moves to active.Signal/ZRTP clients and Let’s Encrypt CA change the game.

This impacts Law Enforcement and Intelligence; focusing on LE.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 9 / 26

Page 12: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

A new default to fight passive attackers

Changes are now detectable.Encryption is here to stay. Passive interception moves to active.Signal/ZRTP clients and Let’s Encrypt CA change the game.This impacts Law Enforcement and Intelligence; focusing on LE.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 9 / 26

Page 13: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Cultural differences

In the US, the UK and in other countries in Europe - searches andnotification are different. Cryptography brings us to a new convergence forall cultures at once.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 10 / 26

Page 14: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

A recent European Court of Human Rights ruling

Oversight isn’t enough: accountability is required

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 11 / 26

Page 15: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Checking validity

Example interactions with the police:

Siren on an otherwise unmarked car pulling over a driver

Drive to a well lit area, dial 112/911, confirm identity of ”officer”

No know raid by armed people

Did they declare they are police? How do we verify it?

Knock at the door with a search warrant

Is it a valid warrant?

Other examples such as a famous Tupac shooting involving police inplain clothing

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 12 / 26

Page 16: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Reality check

In most of these situations - we acknowledge the serious issue of policeimpersonation.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 13 / 26

Page 17: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

How do we detect crimes?

Cyber cyber cyber

(Hint: You will receive nearly no help from any authority!)

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 14 / 26

Page 18: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

How do we detect crimes?

Cyber cyber cyber(Hint: You will receive nearly no help from any authority!)

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 14 / 26

Page 19: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

An example standard of evidence

In the German Chancellor Merkel case there was a supposed lack ofevidence.

Thus we see - we need a new standard of evidence!

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 15 / 26

Page 20: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

An example standard of evidence

In the German Chancellor Merkel case there was a supposed lack ofevidence.Thus we see - we need a new standard of evidence!

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 15 / 26

Page 21: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

A short summary

First, we acknowledge a change in thinking because of Snowden.

Secondly, we see a move towards more and more transparency.

Thirdly, we control those we can control and not those that wedon’t...

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 16 / 26

Page 22: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Wait, control?

I have no democratic control over the majority of services. I do havedemocratic control over a small set of services: local LE, national LE

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 17 / 26

Page 23: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Wait, transparency?

The new protocols force transparency, the proposed standard of evidencegive us data for action; but how might we choose what to act on?

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 18 / 26

Page 24: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Ask the honest parties to prove their honesty

They sign their interception request in real time, point it to a given court(docket, judge, case, etc.) just as with the search of the home.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 19 / 26

Page 25: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

And anyone who doesn’t sign...

Is subject to investigation with the collected evidence.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 20 / 26

Page 26: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Wait, what?

There is no requirement that cryptophone or signal help with this proposal- only that a system of real time notification is implemented by states andtheir relevant agencies.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 21 / 26

Page 27: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Wait, what about TARGETED surveillance

Like cryptography that horse has left the barn with the move from passiveto active.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 22 / 26

Page 28: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Wait, what about malware

The same standard of evidence and notification should apply.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 23 / 26

Page 29: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Help the (honest) police

No ”Golden Key” required

A trade of the secrecy property that keeps security for the majority of usersLaw enforcement is always asking for a way to do this; my proposal allowsan avenue while also asking them to give up secrecy and commit toaccountability and transparency.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 24 / 26

Page 30: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Help the (honest) police

No ”Golden Key” requiredA trade of the secrecy property that keeps security for the majority of users

Law enforcement is always asking for a way to do this; my proposal allowsan avenue while also asking them to give up secrecy and commit toaccountability and transparency.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 24 / 26

Page 31: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Help the (honest) police

No ”Golden Key” requiredA trade of the secrecy property that keeps security for the majority of usersLaw enforcement is always asking for a way to do this; my proposal allowsan avenue while also asking them to give up secrecy and commit toaccountability and transparency.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 24 / 26

Page 32: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

An equal standard

From homes to phones - interference is not secret, lawful processes exist,crimes committed by thousands of unlawful attackers now subject toreporting.

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 25 / 26

Page 33: (Straw) Man in the Middle - Hyperelliptic org · (Straw) Man in the Middle: A Modest Post-Snowden Proposal Brussels, Belgium Jacob Appelbaum [redacted] 10 December 2015 Jacob Appelbaum

Questions?

Jacob Appelbaum ([redacted]) (Straw) Man in the Middle: 10 December 2015 26 / 26